phorphiex | 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

Sharing

Copy URL Twitter E-mail

General

Target
6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
Size 32KB
Sample220515-1hd7baafek
SHA256 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
MD5 629fba91ff579f1e890e489a028d7eb1
SHA1 c6871d6ce30d012e79412761bd6c0c75be37d084
SHA512 5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
SSDEEP 384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex

Malware Config

Signatures

Phorphiex Payload 1 IoCs

resource	yara_rule
sample	family_phorphiex

Phorphiex family
phorphiex

File Explorer

6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

.exe 32KB

6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

IMPHASH 2f944c0518d3a00049e07094b78bdb20
SHA256 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
MD5 629fba91ff579f1e890e489a028d7eb1
SHA1 c6871d6ce30d012e79412761bd6c0c75be37d084
SHA512 5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
SSDEEP 384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz
MD5 SHA1 SHA512 SSDEEP

windows x86

Phorphiex Payload

Minor OS version

Major OS version

Entry point

18202

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memcpy _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit wcsstr wcslen wcscmp _wfopen fseek ftell fclose mbstowcs srand rand memset strlen isalpha isdigit

wininet

HttpQueryInfoA InternetOpenA InternetOpenUrlA InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle

urlmon

URLDownloadToFileW

shlwapi

StrCmpNW PathFileExistsW PathFindFileNameW PathMatchSpecW

kernel32

CopyFileW lstrcmpiW CreateDirectoryW FindFirstFileW lstrcmpW MoveFileExW SetFileAttributesW FindClose RemoveDirectoryW GetLogicalDrives GetDriveTypeW QueryDosDeviceW lstrcpyW GetTickCount GetVolumeInformationW GetModuleFileNameW CreateProcessW CreateThread ExitProcess GetLastError CreateMutexA MoveFileW CopyFileA MoveFileA DeleteFileA GetModuleHandleA GetStartupInfoA FindNextFileW GlobalUnlock GlobalLock GlobalAlloc ExitThread Sleep SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile HeapFree HeapAlloc GetProcessHeap MapViewOfFile CreateFileMappingA GetFileSize CreateFileW DeleteFileW WriteFile ExpandEnvironmentStringsW

user32

SetFocus SetForegroundWindow ShowWindow CloseWindow SetClipboardData CloseClipboard FindWindowA wsprintfA wsprintfW EmptyClipboard GetClipboardData OpenClipboard FindWindowW

advapi32

CryptAcquireContextW CryptDestroyKey CryptImportKey CryptVerifySignatureA CryptHashData CryptCreateHash RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumValueW RegQueryInfoKeyW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegSetValueExW CryptEncrypt

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance